fix(youtrack): OIDC client as an OIDCClient resource, not Ingress annotations

Uses the OIDCClient CRD from #1535; the Ingress carries only routing and DNS again. The Flux Kustomization treats OIDCClient as current on apply, since its Ready reflects Authentik state (the group), as with KumaMonitor.
fix(youtrack): OIDC client from authentik-gate-sync, no blueprint
2026-11-01 09:31:45 +00:00 · 2026-11-01 09:22:40 +00:00 · 2026-11-01 09:16:22 +00:00 · 2026-11-01 08:45:40 +00:00 · 2026-11-01 08:42:43 +00:00
13 changed files with 351 additions and 0 deletions
@@ -0,0 +1,90 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: youtrack
+  namespace: youtrack
+  labels:
+    app.kubernetes.io/name: youtrack
+spec:
+  replicas: 1
+  # One process owns the database directory.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: youtrack
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: youtrack
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      securityContext:
+        runAsNonRoot: true
+        # The image's service account.
+        runAsUser: 13001
+        runAsGroup: 13001
+        fsGroup: 13001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: youtrack
+          image: jetbrains/youtrack:2026.2.19728@sha256:c5e9cedc6fb1d7bcc9b3b56fc3f63e563623e1cd39396161eb70957991583950
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          ports:
+            - name: http
+              containerPort: 8080
+          resources:
+            requests:
+              cpu: 250m
+              memory: 2Gi
+            limits:
+              memory: 4Gi
+          startupProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 10
+            failureThreshold: 60
+          readinessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 30
+            failureThreshold: 4
+          volumeMounts:
+            - name: youtrack
+              mountPath: /opt/youtrack/data
+              subPath: data
+            - name: youtrack
+              mountPath: /opt/youtrack/conf
+              subPath: conf
+            - name: youtrack
+              mountPath: /opt/youtrack/logs
+              subPath: logs
+            - name: youtrack
+              mountPath: /opt/youtrack/backups
+              subPath: backups
+      volumes:
+        - name: youtrack
+          persistentVolumeClaim:
+            claimName: youtrack
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: youtrack
+  namespace: youtrack
+spec:
+  selector:
+    app.kubernetes.io/name: youtrack
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
@@ -0,0 +1,27 @@
+# LAN-only (UDM record via dns.renner.uno/internal); no public label until login goes through Authentik.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: youtrack
+  namespace: youtrack
+  labels:
+    dns.renner.uno/internal: "true"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - youtrack.renner.uno
+      secretName: youtrack-tls
+  rules:
+    - host: youtrack.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: youtrack
+                port:
+                  number: 8080
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pvc.yaml
+  - deployment.yaml
+  - ingress.yaml
+  - oidcclient.yaml
@@ -0,0 +1,13 @@
+# Authentik OIDC client, created by authentik-gate-sync; issuer https://auth.renner.uno/application/o/youtrack/.
+apiVersion: auth.renner.uno/v1alpha1
+kind: OIDCClient
+metadata:
+  name: youtrack
+  namespace: youtrack
+spec:
+  launchURL: https://youtrack.renner.uno
+  group: YouTrack Users
+  redirectURIs:
+    # YouTrack generates the callback when the auth module is created; pin it strict once known.
+    - matchingMode: regex
+      url: ^https://youtrack\.renner\.uno/.*$
@@ -0,0 +1,17 @@
+# YouTrack data, conf, logs and backups (subPaths); Velero youtrack-daily.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: youtrack
+  namespace: youtrack
+  labels:
+    app.kubernetes.io/name: youtrack
+  annotations:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ceph-block
+  resources:
+    requests:
+      storage: 20Gi
@@ -394,3 +394,31 @@ spec:
        status.validationErrors.exists(e, e.startsWith('No backups found for schedule')))))
      current: >-
        has(status.phase) && (status.phase == 'Completed' || status.phase == 'FailedValidation')
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: restore-youtrack
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1h
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/restore/youtrack
+  prune: true
+  wait: true
+  dependsOn:
+    - name: restore-gitea
+    - name: velero-backups-synced
+    - name: infrastructure-ceph-cluster
+  healthCheckExprs:
+    - apiVersion: velero.io/v1
+      kind: Restore
+      failed: >-
+        has(status.phase) && (status.phase in ['Failed', 'PartiallyFailed'] ||
+        (status.phase == 'FailedValidation' && !(has(status.validationErrors) &&
+        status.validationErrors.exists(e, e.startsWith('No backups found for schedule')))))
+      current: >-
+        has(status.phase) && (status.phase == 'Completed' || status.phase == 'FailedValidation')
@@ -0,0 +1,25 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: youtrack
+  namespace: flux-system
+spec:
+  interval: 10m
+  retryInterval: 1m
+  timeout: 15m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./kubernetes/apps/youtrack
+  prune: true
+  wait: true
+  # OIDCClient Ready tracks Authentik (e.g. the group exists), not this apply.
+  healthCheckExprs:
+    - apiVersion: auth.renner.uno/v1alpha1
+      kind: OIDCClient
+      current: "true"
+  dependsOn:
+    - name: restore-youtrack
+    - name: infrastructure
+    - name: infrastructure-crds
+    - name: infrastructure-ceph-cluster
@@ -83,6 +83,11 @@ metadata:
 ---
 apiVersion: v1
 kind: Namespace
+metadata:
+  name: youtrack
+---
+apiVersion: v1
+kind: Namespace
 metadata:
  name: immich
 ---
@@ -32,6 +32,7 @@ resources:
  - wordpress-ns.yaml
  - ai-ns.yaml
  - navidrome-ns.yaml
+  - youtrack-ns.yaml
  - uptime-monitor-ns.yaml
  - kuma-sync-ns.yaml
  - cloudflare-lb-sync-ns.yaml
@@ -0,0 +1,107 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: youtrack
+spec:
+  endpointSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": youtrack
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - fromEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": monitoring
+    - fromEntities:
+        - host
+        - remote-node
+    # ICMP — all standard ICMPv4 + ICMPv6 from any cluster pod. See
+    # home-assistant-ns.yaml for the rationale (CT-RELATED path not
+    # passing related ICMP empirically; per-namespace shape, mirroring
+    # commit 3c517a0's verified-safe pattern with the 66dbe9f type set).
+    - fromEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": youtrack
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": ingress
+            app.kubernetes.io/name: traefik
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+    # host/remote-node: kubelet probes + node-local reach (Ceph mons on host net)
+    - toEntities:
+        - host
+        - remote-node
+    # ICMP — egress mirror; see ingress block above.
+    - toEndpoints:
+        - matchExpressions:
+            - key: io.kubernetes.pod.namespace
+              operator: Exists
+      icmps:
+        - fields:
+            - { type: 0,   family: IPv4 }
+            - { type: 3,   family: IPv4 }
+            - { type: 8,   family: IPv4 }
+            - { type: 11,  family: IPv4 }
+            - { type: 12,  family: IPv4 }
+            - { type: 1,   family: IPv6 }
+            - { type: 2,   family: IPv6 }
+            - { type: 3,   family: IPv6 }
+            - { type: 4,   family: IPv6 }
+            - { type: 128, family: IPv6 }
+            - { type: 129, family: IPv6 }
+            - { type: 133, family: IPv6 }
+            - { type: 134, family: IPv6 }
+            - { type: 135, family: IPv6 }
+            - { type: 136, family: IPv6 }
+            - { type: 143, family: IPv6 }
+---
+# Outbound HTTPS: OIDC discovery/token/JWKS at auth.renner.uno (Traefik VIP, matched as traefik
+# pods above) and JetBrains services (license, update check), mail-free.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: youtrack-egress-https
+  namespace: youtrack
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities:
+        - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
@@ -369,3 +369,23 @@ spec:
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: synapse
+---
+apiVersion: velero.io/v1
+kind: Schedule
+metadata:
+  name: youtrack-daily
+  namespace: velero
+  labels:
+    app.kubernetes.io/part-of: homelab-backup
+spec:
+  # Daily at 10:15 local, next free stagger slot after matrix-daily at 09:45.
+  schedule: "15 10 * * *"
+  useOwnerReferencesInBackup: false
+  template:
+    includedNamespaces:
+      - youtrack
+    includedResources:
+      - persistentvolumeclaims
+    storageLocation: default
+    ttl: 720h0m0s
+    snapshotMoveData: true
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - restore.yaml
@@ -0,0 +1,7 @@
+apiVersion: velero.io/v1
+kind: Restore
+metadata:
+  name: youtrack
+  namespace: velero
+spec:
+  scheduleName: youtrack-daily
Author	SHA1	Message	Date
hermes-bot	14dc5247b7	fix(youtrack): OIDC client as an OIDCClient resource, not Ingress annotations ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Uses the OIDCClient CRD from #1535; the Ingress carries only routing and DNS again. The Flux Kustomization treats OIDCClient as current on apply, since its Ready reflects Authentik state (the group), as with KumaMonitor.	2026-11-01 09:31:45 +00:00
hermes-bot	68d1a174db	fix(youtrack): OIDC client from authentik-gate-sync, no blueprint ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details The provider, application and group policy are now created by authentik-gate-sync from the Ingress annotations auth.renner.uno/oidc-client and auth.renner.uno/group (#1535); the youtrack.yaml blueprint is gone. The group YouTrack Users stays managed in Authentik.	2026-11-01 09:22:40 +00:00
hermes-bot	7efc62e216	fix(youtrack): take the YouTrack Users group out of the blueprint ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details Groups are managed in Authentik itself. The blueprint now only binds the application to the group by name (!Find). The YouTrack entries move to their own blueprint (youtrack.yaml). Authentik imports a blueprint atomically (importer.py apply() runs _apply_models in one transaction), so while the group does not exist the whole YouTrack blueprint rolls back: no provider, no application, login closed. In the shared OAuth2 blueprint the same miss would also have blocked every other provider.	2026-11-01 09:16:22 +00:00
hermes-bot	f50b33cadf	fix(youtrack): manage YouTrack Users members in Authentik, not the blueprint ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline failed Details Same as Wiki Readers: the blueprint only ensures the group exists, because the application's policy binding refers to it; membership is edited in Authentik.	2026-11-01 08:45:40 +00:00
hermes-bot	f96737c576	feat(youtrack): YouTrack Server, LAN only, login through Authentik ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details Namespace youtrack: jetbrains/youtrack 2026.2.19728 (digest-pinned), one replica with Recreate, PVC youtrack (data/conf/logs/backups as subPaths), Velero youtrack-daily plus restore-youtrack like the other apps. The Ingress carries only dns.renner.uno/internal, so the UDM gets a record and netbird-service-sync publishes nothing: the host is not reachable from the internet until login goes through Authentik and a later PR adds the public label. Authentik blueprint: group YouTrack Users, confidential OIDC provider (client_id youtrack; YouTrack's OpenID Connect auth module requires a client secret), application slug youtrack, bound to the group. YouTrack Server has no documented unattended first install (2026.2 docs: the Configuration Wizard is mandatory, the skip flag exists for upgrades only), so the wizard and the auth module are a one-time owner step, accepted by the owner.	2026-11-01 08:42:43 +00:00